Skip to content
Threat Feed
Subscribe
high advisory

Arbitrary File Deletion in Podlove Podcast Publisher Plugin for WordPress

Authenticated attackers can exploit a path traversal vulnerability in the Podlove Podcast Publisher plugin to delete arbitrary system files, potentially achieving remote code execution via POP chain or wp-config.php removal.

CVE search metadata

CVE search record: CVE-2026-16099. Severity: high. CVSS: 8.8. KEV: no. Product: Podlove Podcast Publisher. Brief: Arbitrary File Deletion in Podlove Podcast Publisher Plugin for WordPress. Brief link: https://feed.craftedsignal.io/briefs/2026-08-podlove-arbitrary-file-deletion/

The Podlove Podcast Publisher plugin for WordPress (versions 4.5.3 and earlier) contains a critical vulnerability due to insufficient file path validation within the 'create_link_item' function. Authenticated users with contributor-level privileges or higher can leverage this flaw to delete arbitrary files on the web server. This capability poses a significant risk to site integrity and availability, as attackers can delete core WordPress configuration files like 'wp-config.php' to force a re-installation or trigger further exploit chains.

Furthermore, researchers identified a property-oriented programming (POP) chain within the 'Podlove\ImageCache\GenerationGuard' class. An attacker can supply serialized data that, when unserialized, populates the object's properties to invoke 'wp_delete_file()' on a target file of their choosing. This facilitates remote code execution (RCE) scenarios by removing specific application files that redirect execution flow or weaken security postures. Given the plugin's broad utility in podcast hosting, defenders should prioritize patching or disabling the plugin until version 4.5.4 or later is deployed.

Impact

Successful exploitation allows for the deletion of arbitrary files on the underlying filesystem, provided the web server process has the necessary file system permissions. This can lead to a complete denial of service for the WordPress site, the destruction of critical configuration files, or facilitate RCE through the identified POP chain mechanism. Impacted organizations include any entities running affected versions of the Podlove Podcast Publisher plugin on WordPress infrastructure.

Recommendation

  • Upgrade the Podlove Podcast Publisher plugin to version 4.5.4 or later immediately to resolve the path validation flaw.
  • Implement access control reviews to ensure contributor-level accounts are restricted appropriately, minimizing the potential impact of authenticated exploit vectors.
  • Audit web server access logs for anomalous POST requests directed at plugin-specific API endpoints that handle file linking or management.